Overview
FlexOrch uses API keys for authentication. Every request must include a valid key.
API keys follow the format:
Keys are tied to your account. All requests made with a key are scoped to your workspace.
Generating a key
- Sign in to app.flexorch.com
- Go to Settings → API Keys
- Click Generate New Key
- Copy the key immediately — it is shown only once
You can generate multiple keys (e.g., one per environment or integration).
Using a key
Pass the key in the X-API-KEY header:
Never expose API keys in client-side code, public repositories, or logs.
Revoking a key
- Go to Settings → API Keys
- Click Revoke next to the key you want to remove
Revoked keys stop working immediately.
Security best practices
- Store keys in environment variables, never in source code
- Use separate keys per environment (development, staging, production)
- Rotate keys periodically — revoke old ones after issuing new ones
- Set up a
.env file and add it to .gitignore
Rate limits
API key requests are subject to plan-based rate limits. If you exceed your limit, the API returns 429 Too Many Requests.
Check your current usage and limits:
On 429, wait for reset_in_seconds before retrying. The SDK handles this automatically with exponential backoff.